USN-6512-1: LibTIFF vulnerabilities
23 November 2023
Several security issues were fixed in LibTIFF.
Releases
Packages
- tiff - Tag Image File Format (TIFF) library
Details
It was discovered that LibTIFF could be made to run into an infinite loop.
If a user or an automated system were tricked into opening a specially
crafted image file, an attacker could possibly use this issue to cause a
denial of service. (CVE-2022-40090)
It was discovered that LibTIFF could be made leak memory. If a user or an
automated system were tricked into opening a specially crafted image file,
an attacker could possibly use this issue to cause a denial of service.
(CVE-2023-3576)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.04
Ubuntu 20.04
Ubuntu 18.04
-
libtiff-tools
-
4.0.9-5ubuntu0.10+esm4
Available with Ubuntu Pro
-
libtiff5
-
4.0.9-5ubuntu0.10+esm4
Available with Ubuntu Pro
Ubuntu 16.04
-
libtiff-tools
-
4.0.6-1ubuntu0.8+esm14
Available with Ubuntu Pro
-
libtiff5
-
4.0.6-1ubuntu0.8+esm14
Available with Ubuntu Pro
Ubuntu 14.04
-
libtiff-tools
-
4.0.3-7ubuntu0.11+esm11
Available with Ubuntu Pro
-
libtiff5
-
4.0.3-7ubuntu0.11+esm11
Available with Ubuntu Pro
In general, a standard system update will make all the necessary changes.